Completing the Security Risk Assessment
The SRA page turns the HHS/OCR SRA workbook into a guided questionnaire that becomes easier to complete as HIPAAList records improve.
Security Risk Assessment
Built from the HHS/OCR Security Risk Assessment Tool. HIPAAList helps organize answers, related work, and risk follow-up.
Autosaved May 27, 2026, 3:54 PM
Questions Answered
2 / 126
2% answered
Current Risks
1
Open follow-up
Resolved Risks
1
Risk history
Questions
Has your practice completed a security risk assessment (SRA) before?
Suggested Suggested because no saved SRA version exists yet.
Do you review and update your SRA?
Suggested Suggested because SRA review is part of this HIPAAList workflow.
Do you include all information systems containing, processing, and/or transmitting ePHI in your SRA?
1. Answer workbook questions without starting from scratch
The SRA page follows the workbook section structure and answer options, then stores one autosaved draft for the organization.
Once every question is answered, the organization can save an SRA version. Later changes update the draft until the next completed version is saved, so the assessment can keep improving over time.
3. Use the Risks table for SRA follow-up
The Risks table collects Action-scoped risks in one place. Open risks stay surfaced until they are resolved, while resolved risks remain available for assessment history.
Clicking a risk opens the related Action and can take the user directly to the risk detail.